CVE WatchJul 15, 2026

CVE-2026-34486

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInte

CVSS

7.5

High

EPSS

21.7%

p97

KEV

—

Exploit Today

0-100

Published: Apr 9, 2026 · Last modified: Jul 15, 2026 · CWE-311 · CWE-807

EPSS · 30d

15.8%EPSS · 30 days21.7%

2026-06-302026-07-16

Technical description

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2022-262817.5 HIG

56.5%

——17BigAnt Server v5.6.06 was discovered to contain an incorrect access control issue.8d CVE-2026-241209.8 CRI

55.5%

——17vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.10.5.2d CVE-2021-406506.5 MED

50.0%

——15In Connx Version 6.2.0.1269 (20210623), a cookie can be issued by the application and not have the secure flag set.8d CVE-2023-318257.5 HIG

47.0%

——14An issue found in Inageya v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Inageya function.8d CVE-2023-318227.5 HIG

47.0%

——14An issue found in Entetsu Store v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Entetsu Store function.8d CVE-2023-318207.5 HIG

47.0%

——14An issue found in Shizutetsu Store v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp function.8d